Workstations VLAN and ports for Joining and Functioning on domain.

UDP 88 Kerberos is needed, but do not forget with Win 7 and 2008 R2 DC's you need TCP 88 as well.

135,389,443,139 are needed.

UDP 389 is needed for joining the domain with Server 2008 R2 DC's

1025-5000 XP clients
42152-65535 Windows 7 clients

Addtionaly 123 NTP